Quantum Algorithms for the Subset-Sum Problem
Total Page:16
File Type:pdf, Size:1020Kb
Quantum algorithms for the subset-sum problem Daniel J. Bernstein1;2, Stacey Jeffery3, Tanja Lange2, and Alexander Meurer4 1 Department of Computer Science University of Illinois at Chicago Chicago, IL 60607{7045, USA [email protected] 2 Department of Mathematics and Computer Science Technische Universiteit Eindhoven P.O. Box 513, 5600 MB Eindhoven, The Netherlands [email protected] 3 Institute for Quantum Computing, University of Waterloo, Canada [email protected] 4 Ruhr-University Bochum, Horst G¨ortzInstitute for IT-Security [email protected] Abstract. This paper introduces a subset-sum algorithm with heuristic asymptotic cost exponent below 0:25. The new algorithm combines the 2010 Howgrave-Graham{Joux subset-sum algorithm with a new stream- lined data structure for quantum walks on Johnson graphs. Keywords: subset sum, quantum search, quantum walks, radix trees, decoding, SVP, CVP 1 Introduction The subset-sum problem is the problem of deciding, given integers x1; x2; : : : ; xn P and s, whether there exists a subset I of f1; 2; : : : ; ng such that i2I xi = s; i.e., whether there exists a subsequence of x1; x2; : : : ; xn with sum s. Being able to solve this decision problem implies being able to find such a subset if one exists: for n > 1 one recursively tries x1; x2; : : : ; xn−1 with sum s or, if that fails, sum s − xn. The reader should imagine, as a typical \hard" case, that x1; x2; : : : ; xn are n independent uniform random integers in f0p; 1;:::; 2 g, and thatps is chosen as a uniform random integer between (n=2 − n)2n−1 and (n=2 + n)2n−1. The P number of subsets I ⊆ f1; 2; : : : ; ng with i2I xi = s then has a noticeable chance of being larger than 0 but is quite unlikely to be much larger, say larger than n. This work was supported by the National Science Foundation under grant 1018836, by the Netherlands Organisation for Scientific Research (NWO) under grant 639.073.005, by NSERC Strategic Project Grant FREQUENCY, by the US ARO, and by the European Commission under Contract ICT-2007-216676 ECRYPT II. Permanent ID of this document: 797dcbe9c3389410ae4d5ae6dba33ab7. Date: 2013.04.07. 2 Bernstein, Jeffery, Lange, Meurer The subset-sum problem is, historically, one of the first problems to be proven NP-complete. A polynomial-time non-quantum algorithm for the subset-sum problem would violate the standard P 6= NP conjecture; a polynomial-time quantum algorithm for the subset-sum problem would violate the standard NP 6⊆ BQP conjecture. There is, however, a very large gap between polyno- mial time and the time needed for a naive search through all 2n subsets of f1; 2; : : : ; ng. The standard NP 6⊆ BQP conjecture does not rule out faster exponential-time algorithms, or even subexponential-time algorithms, or even algorithms that take polynomial time for most inputs. This paper studies faster exponential-time algorithms. Variations. Often one is interested only in sums of fixed weight, or of limited weight. We are now given integers x1; x2; : : : ; xn, s, and w; the problem is to P decide whether there is a subset I of f1; 2; : : : ; ng such that i2I xi = s and #I = w. In the special case s = 0 with w 6= 0, such a subset I immediately produces a short nonzero vector in the lattice L of vectors v 2 Zn satisfying P x v = 0: specifically, the characteristic function of I is a vector of length p i i i w in L. In many applications this is the shortest nonzero vector in L; in some applications this vector can be found by standard SVP algorithms. n P For s 6= 0 one can instead compute a vector r 2 R satisfying i xiri = s, and then observe that subtracting the characteristic function of I from r produces an element of L. In many applications this is the vector in L closest to r; in some applications this vector can be found by standard CVP algorithms. A variant of the same problem is the central algorithmic problem in coding theory. The input now consists of vectors x1; x2; : : : ; xn, a vector s, and an integer w; these vectors all have the same length and have entries in the field F2 of integers modulo 2. The problem, as above, is to decide whether there is a subset P I of f1; 2; : : : ; ng such that i2I xi = s and #I = w. We do not mean to suggest that these problems are identical. However, the algorithmic techniques used to attack subset-sum problems are among the central algorithmic techniques used to attack lattice problems and decoding problems. For example, the best attack known against code-based cryptography, at least asymptotically, is a very recent decoding algorithm by Becker, Joux, May, and Meurer [4], improving upon a decoding algorithm by May, Meurer, and Thomae [24]; the algorithm of [4] is an adaptation of a subset-sum algorithm by Becker, Coron, and Joux [3], improving analogously upon a subset-sum algorithm by Howgrave-Graham and Joux [17]. There is also a line of work on building cryptographic systems whose security is more directly tied to the subset-sum problem. For example, Lyubashevsky, Palacio, and Segev in [22] propose a public-key encryption system and prove that being able to break it implies being able to solve modular subset-sum problems of the following type: find a random subset I ⊆ f1; 2; : : : ; ng given random P x1; x2; : : : ; xn modulo M and given i2I xi modulo M, where M is roughly (10n log n)n. They claim in [22, Section 1] that \there are currently no known quantum algorithms that perform better than classical ones on the subset sum problem". Quantum algorithms for the subset-sum problem 3 Exponent Quantum Split Algorithm 1 No 1 Brute force 0.5 Yes 1 Quantum search; x2 0.5 No 1/2 Left-right split; x2 0.5 No 1/4 Left-right split with a modulus; x4 0.375 Yes 1/4 Quantum search with a modulus; x4 0.337. No 1/16 Moduli + representations; x5 0.333. Yes 1/3 Quantum left-right split; x2 0.333. Yes 1/2 Quantum walk; x3 0.3 Yes 1/4 Quantum walk with a modulus; x4 0.291. No 1/16 Moduli + representations + overlap; [3] 0.241. Yes 1/16 New; quantum walk + moduli + representations; x5 Table 1.1. Heuristic asymptotic performance of various subset-sum algorithms. An algorithm using 2(e+o(1))n operations is listed as \exponent" e. Contents of this paper. We introduce the first subset-sum algorithm that beats 2n=4. Specifically, we introduce a quantum algorithm that, under rea- sonable assumptions, uses at most 2(0:241:::+o(1))n qubit operations to solve a subset-sum problem. This algorithm combines quantum walks with the central \representations" idea of [17]. Table 1.1 compares this exponent 0:241 ::: to the exponents of other algorithms. One can reasonably speculate that analogous quantum speedups can also be applied to the algorithms of [24] and [4]. However, establishing this will require considerable extra work, similar to the extra work of [24] and [4] compared to [17] and [3] respectively. Cost metric and other conventions. This paper follows the tradition of measuring algorithm cost as the number of bit operations or, more generally, qubit operations. In particular, random access to an array of size 2O(n) is assumed to cost only nO(1), even if the array index is a quantum superposition. We systematically suppress cost factors polynomial in n; our concern is with asymptotic exponents such as the 0:241 ::: in 2(0:241:::+o(1))n. We also assume O(1) that the inputs x1; x2; : : : ; xn; s have n bits. These conventions mean, for example, that reading the entire input x1; x2; : : : ; xn; s costs only 1. Almost all of the algorithms discussed here split size-n sets into parts, either 2 or 3 or 4 or 16 parts, as indicated by the \Split" column in Table 1. Any reasonably balanced split is adequate, but to simplify the algorithm statements we assume that n is a multiple of 2 or 3 or 4 or 16 respectively. The algorithms in this paper are designed to work well for random inputs, particularly in the \hard" case that x1; x2; : : : ; xn; s each have about n bits. Our analyses | like the analyses of state-of-the-art algorithms for integer factoriza- tion, discrete logarithms, and many other problems of cryptographic interest | are heuristic. We do not claim that the algorithms work for all inputs, and we do not claim that what we call the \hard" case is the worst case. Even for ran- dom inputs we do not claim that our analyses are proven, but we do speculate 4 Bernstein, Jeffery, Lange, Meurer that they are provable by an adaptation of the proof ideas stated in [17, eprint version]. Acknowledgments. This work was initiated during the Post-Quantum Cryp- tography and Quantum Algorithms workshop at the Lorentz Center in Novem- ber 2012. We acknowledge helpful discussions with Andris Ambainis, Fr´ed´eric Magniez, Nicolas Sendrier, and Jean-Pierre Tillich. 2 Searches P Define Σ as the function that maps I ⊆ f1; 2; : : : ; ng to i2I xi. Recall that we O(1) assume that x1; x2; : : : ; xn; s have n bits, and that we suppress polynomial cost factors; evaluating Σ therefore has cost 1. The subset-sum problem is the problem of deciding whether there exists I with Σ(I) = s, i.e., whether the function Σ − s has a root.